As you may already met, ClamAV will mark most of mails which composed in HTML format as 'Exploit.PDF-9669' virus, this is an issue in ClamAV old version, it can be solved by update ClamAV to the lastest 0.95.3 version. So we suggest you update it AS SOON AS POSSIBLE.

All RHEL/CentOS users can update it via below command with iRedMail yum repository:

# yum update clamav clamav-db clamd

Debian/Ubuntu users can update it via apt-get (if no new version available, please push the package maintainers):